feature: fraxusd support #82

shinchann221 · 2025-12-15T21:00:38Z

No description provided.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

src/modules/frax/FraxModule.sol

certora-run

Verification Results

Group ID: 1c854897-c7c7-4558-8ae4-fb6925dc59aa

Job	Result	VERIFIED	Link
EtherFiSafe.conf	✅	14	Link
CashModuleCore.conf --rule "p03"	✅	2	Link

certora-run

Verification Results

Group ID: 89673d9d-43f9-45cb-a3a7-8df45a134557

Job	Result	VERIFIED	Link
EtherFiSafe.conf	✅	14	Link
CashModuleCore.conf --rule "p03"	✅	2	Link

certora-run

Verification Results

Group ID: 152f5db5-2410-4eb8-a7ed-8eb6fc71107c

Job	Result	VERIFIED	Link
EtherFiSafe.conf	✅	14	Link
CashModuleCore.conf --rule "p03"	✅	2	Link

src/modules/frax/FraxModule.sol

certora-run

Verification Results

Group ID: d26b8327-7508-4f4c-bcdf-5fa2f0a8c051

Job	Result	VERIFIED	Link
EtherFiSafe.conf	✅	14	Link
CashModuleCore.conf --rule "p03"	✅	2	Link

certora-run

Verification Results

Group ID: 8537ae10-fbba-4edb-9ef6-3a374a7f23f7

Job	Result	VERIFIED	Link
EtherFiSafe.conf	✅	14	Link
CashModuleCore.conf --rule "p03"	✅	2	Link

certora-run

Verification Results

Group ID: 87f3badb-36f8-4be1-954b-026a69095d4b

Job	Result	VERIFIED	Link
EtherFiSafe.conf	✅	14	Link
CashModuleCore.conf --rule "p03"	✅	2	Link

src/modules/frax/FraxModule.sol

certora-run

Verification Results

Group ID: 5c715de3-ec7b-4272-8f5a-1200fb9277ae

Job	Result	VERIFIED	Link
EtherFiSafe.conf	⌛	0	Link
CashModuleCore.conf --rule "p03"	✅	2	Link

scripts/DeployFraxModule.s.sol

src/modules/frax/FraxModule.sol

certora-run

Verification Results

Group ID: e4d5d80a-1afa-48f1-8503-e41939a7e9c9

Job	Result	VERIFIED	Link
EtherFiSafe.conf	✅	14	Link
CashModuleCore.conf --rule "p03"	✅	2	Link

certora-run

Verification Results

Group ID: c71a3e0e-cebf-4625-be9a-387dc65eac8f

Job	Result	VERIFIED	Link
EtherFiSafe.conf	✅	14	Link
CashModuleCore.conf --rule "p03"	✅	2	Link

shinchann221 · 2026-01-09T21:59:18Z

FraxModule Improvements and Changes

Overview

This document outlines the security fixes, improvements, and new features implemented in the FraxModule contract to address critical issues and align with system requirements.

1. H-01 Missing Withdrawal Cancellation Mechanism Leading to DoS

Recommendation

Make sure to implement the cancellation flow similarly to how it has been done in EtherFiLiquidModule - this includes both a cancellation hook and a manual cancellation function.

Files Changed

src/modules/frax/FraxModule.sol

Changes Made

✅ Implemented IBridgeModule interface
✅ Added cancelBridgeByCashModule(address safe) function for CashModule to cancel withdrawals
✅ Added cancelAsyncWithdraw(address safe, address[] calldata signers, bytes[] calldata signatures) function for manual cancellation by safe owners
✅ Added CANCEL_ASYNC_WITHDRAW_SIG constant for signature verification
✅ Added _checkCancelAsyncWithdrawSignature helper function
✅ Added AsyncWithdrawalCancelled event
✅ Added Unauthorized and InvalidSignatures errors

2. M-01 Loss of value in Async Withdrawals due to Decimal Truncation

Recommendation

Validate in requestAsyncWithdraw (or _requestAsyncWithdraw) that the _withdrawAmount is a multiple of the dust threshold to ensure the full amount can be bridged.

Files Changed

src/modules/frax/FraxModule.sol

Changes Made

✅ Added DUST_THRESHOLD constant set to 1e12
✅ Added AmountContainsDust error
✅ Added validation in _requestAsyncWithdraw to check _withdrawAmount % DUST_THRESHOLD != 0 and revert with AmountContainsDust if not a multiple

3. L-01 Incompatibility with Custodian Async Deposit Flow (DoS)

Recommendation

The module should either explicitly support the async flow (accepting fees and skipping the immediate balance check) or, if the intention is to only support synchronous deposits, it should validate the Custodian's state (available assets) before attempting the deposit to prevent gas wastage on doomed transactions.

We only want to keep the synchronous flow.

Files Changed

src/modules/frax/FraxModule.sol

Changes Made

✅ Added InsufficientCustodianBalance error
✅ Added validation in _deposit to check custodian's fraxusd balance before attempting deposit
✅ Validates that ERC20(fraxusd).balanceOf(custodian) >= minReturnAmount to ensure synchronous deposit is possible
✅ Prevents gas wastage on transactions that would fail due to insufficient custodian balance

4. I-01. Missing Asset Validation Against Custodian Configuration

Recommendation

Add a check in _deposit to ensure assetToDeposit == custodian.custodianTkn() and a similar check in _withdraw for outputAsset.

Resolution

We have acknowledged the issue.

5. Missing Input Validation

Description

The constructor did not validate that _custodian address is not zero, which could lead to deployment with invalid configuration.

Recommendation

Add zero address validation for custodian in constructor.

Files Changed

src/modules/frax/FraxModule.sol

Changes Made

✅ Added _custodian == address(0) check in constructor validation

Summary of All Changes

New Constants

DUST_THRESHOLD = 1e12 - Dust threshold for LayerZero OFT decimal conversion
CANCEL_ASYNC_WITHDRAW_SIG - TypeHash for cancel async withdraw function signature

New Errors

AmountContainsDust() - Thrown when withdrawal amount contains dust
InsufficientCustodianBalance() - Thrown when custodian has insufficient balance for synchronous deposit
Unauthorized() - Thrown when caller lacks proper authorization
InvalidSignatures() - Thrown when signatures are invalid

New Events

AsyncWithdrawalCancelled(address indexed safe, uint256 amountToWithdraw, uint32 dstEid, address to) - Emitted when async withdrawal is cancelled

New Functions

cancelBridgeByCashModule(address safe) - Hook for CashModule to cancel withdrawals
cancelAsyncWithdraw(address safe, address[] calldata signers, bytes[] calldata signatures) - Manual cancellation by safe owners
_checkCancelAsyncWithdrawSignature(...) - Helper for signature verification

Interface Implementation

Contract now implements IBridgeModule interface

Validations Added

✅ Dust threshold validation in _requestAsyncWithdraw
✅ Custodian balance validation in _deposit
✅ Constructor validation for custodian address

Impact

These changes ensure the module:

✅ Properly handles cancellation flows to prevent DOS scenarios
✅ Prevents dust locking in async withdrawals
✅ Validates synchronous deposit requirements
✅ Maintains consistency with other bridge modules in the system
✅ Provides proper error handling and user feedback

certora-run

Verification Results

Group ID: 7ae8ea6c-f53a-45d6-b279-3cad90027222

Job	Result	VERIFIED	Link
EtherFiSafe.conf	✅	14	Link
CashModuleCore.conf --rule "p03"	✅	2	Link

created frax module

dd74333

shinchann221 requested a review from shivam-ef December 15, 2025 21:00

chatgpt-codex-connector bot reviewed Dec 15, 2025

View reviewed changes

src/modules/frax/FraxModule.sol Outdated Show resolved Hide resolved

certora-run bot reviewed Dec 15, 2025

View reviewed changes

shinchann221 added 3 commits December 16, 2025 09:17

added validation for usdc withdrawal amount

d59050d

added test cases

01b7350

removed test.txt

1c4a7f4

certora-run bot reviewed Dec 16, 2025

View reviewed changes

added deploy script for dev

82a0085

certora-run bot reviewed Dec 17, 2025

View reviewed changes

added usdt price oracle for frax

0e4a986

shinchann221 commented Dec 18, 2025

View reviewed changes

src/modules/frax/FraxModule.sol Outdated Show resolved Hide resolved

shivam-ef added 2 commits December 18, 2025 16:19

frax module deployed

ba64f82

fix: test for frax

477dad6

certora-run bot reviewed Dec 18, 2025

View reviewed changes

updated fraxmodule for async withdrawal

61f7010

certora-run bot reviewed Dec 19, 2025

View reviewed changes

updated async withdrawals

e88332c

certora-run bot reviewed Dec 22, 2025

View reviewed changes

shivam-ef reviewed Dec 30, 2025

View reviewed changes

src/modules/frax/FraxModule.sol Outdated Show resolved Hide resolved

src/modules/frax/FraxModule.sol Outdated Show resolved Hide resolved

src/modules/frax/FraxModule.sol Outdated Show resolved Hide resolved

shinchann221 added 2 commits December 30, 2025 16:38

resolved decimal

aa74276

Merge branch 'master' into feature/frax-support

bfe994c

certora-run bot reviewed Dec 30, 2025

View reviewed changes

shivam-ef reviewed Dec 31, 2025

View reviewed changes

resolved review comments

e0a75b4

certora-run bot reviewed Dec 31, 2025

View reviewed changes

fix: bytes32 coversion

e5afcf7

certora-run bot reviewed Jan 7, 2026

View reviewed changes

fix: audit issues & updated test cases

84b33d3

certora-run bot reviewed Jan 9, 2026

View reviewed changes

feature: fraxusd support #82

Are you sure you want to change the base?

feature: fraxusd support #82

Conversation

shinchann221 commented Dec 15, 2025

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

certora-run bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Verification Results

Uh oh!

certora-run bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Verification Results

Uh oh!

certora-run bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Verification Results

Uh oh!

Uh oh!

certora-run bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Verification Results

Uh oh!

certora-run bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Verification Results

Uh oh!

certora-run bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Verification Results

Uh oh!

Uh oh!

Uh oh!

Uh oh!

certora-run bot left a comment

Choose a reason for hiding this comment

Verification Results

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

certora-run bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Verification Results

Uh oh!

certora-run bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Verification Results

Uh oh!

shinchann221 commented Jan 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

FraxModule Improvements and Changes

Overview

1. H-01 Missing Withdrawal Cancellation Mechanism Leading to DoS

Recommendation

Files Changed

Changes Made

2. M-01 Loss of value in Async Withdrawals due to Decimal Truncation

Recommendation

Files Changed

Changes Made

3. L-01 Incompatibility with Custodian Async Deposit Flow (DoS)

Recommendation

Files Changed

Changes Made

certora-run bot left a comment •

edited

Loading

certora-run bot left a comment •

edited

Loading

certora-run bot left a comment •

edited

Loading

certora-run bot left a comment •

edited

Loading

certora-run bot left a comment •

edited

Loading

certora-run bot left a comment •

edited

Loading

certora-run bot left a comment •

edited

Loading

certora-run bot left a comment •

edited

Loading

shinchann221 commented Jan 9, 2026 •

edited

Loading

certora-run bot left a comment •

edited

Loading